Preserve the TrueNAS configuration secret seed for system recovery

Bottom line: Decide whether the saved configuration can restore its encrypted fields on the intended recovery system. Keep that question separate from whether an administrator can log in and whether storage data has its own protected recovery copy.

Source fact: what the authority says

The TrueNAS backup guide directs configuration downloads to include Export Password Secret Seed for restoration to a different operating-system device. The seed decrypts encrypted fields in the configuration database; without it, a restored configuration receives a new seed and cannot read those fields. The guide distinguishes this from existing web UI login passwords and API keys, which are stored as one-way hashes and are not affected by a missing seed. It says a missing seed disables local-user SMB authentication and removes or empties several encrypted settings, including cloud credentials and service passwords.

What the source does not establish

This article addresses configuration-field recovery in the versioned guide. It does not establish a storage-data backup or validate an arbitrary configuration on another release. DSE treats a successful login as one observation, leaving the required services and protected data to their own recovery checks.

Applicability questions

• Which configuration generation represents the state the owner intends to recover?
• Does the export include the secret seed, and where is the protected recovery copy?
• Which services depend on encrypted configuration values in the actual deployment?
• What separate recovery evidence covers stored data, keys and the intended replacement system?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends a recovery record that identifies the configuration generation and whether the seed was included without exposing the seed or other secret values. Assign authorized retrieval to the recovery owner and keep ordinary reports free of reusable credentials. Review the protected copy after a configuration change rather than assuming the initial installation export still represents the intended state.

For a proposed recovery exercise, select a representative service that depends on encrypted settings and a separate administrator-login check. Have each owner state the expected recovered state before the exercise. Keep the export, intended release and target system together so the team does not improvise a cross-version restoration simply to obtain a login screen.

Plan how required service settings will be reconciled if the available export lacks its seed. Do not reset account passwords or recreate credentials merely to make a rehearsal look complete without the relevant owner’s decision. Preserve the original configuration and stop when a required encrypted value or supporting recovery dependency cannot be accounted for.

Make the service checklist concrete: name the actual authentication or integration workflow the recovery owner needs, the authorized test identity and the expected configuration reference. Keep a missing secret-dependent setting visible even when the separate administrator-login check succeeds.

Verification and evidence

Proposed verification: use an isolated representative recovery system and the applicable official restoration procedure. Verify the selected configuration generation, then perform the administrator and agreed service checks as separate observations. Inspect sensitive values only through the authorized recovery workflow; retain identifiers and redacted results in the evidence record.

Compare the observed service configuration with the owner’s expected state and record every missing setting. Assess storage-data recovery separately using its own selected recovery point. Retain the protected-export location, version, test target, retrieval authorization and outcomes so another recovery operator can repeat the assessment without receiving the secrets in a general change record.

Official references

• TrueNAS — Backing Up TrueNAS — official product documentation; confirm the installed release and configuration.

Source review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change.